PT-2012-3603 · Microsoft · Office Sharepoint Server 2007+3

Published 2012-07-10 · Updated 2018-10-12 · CVE-2012-1860

Positive Technologies (AI Summary)

CVSS v2.0

5.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:N/A:P

Name of the Vulnerable Software and Affected Versions Microsoft Office SharePoint Server 2007 versions SP2 through SP3 SharePoint Server 2010 versions Gold through SP1 Office Web Apps 2010 versions Gold through SP1

Description The issue allows remote authenticated users to obtain sensitive information or cause a denial of service by changing a parameter in a search-scope URL. An information disclosure vulnerability exists in the way that SharePoint stores search scopes, which could allow an attacker to view or tamper with other users' search scopes.

Recommendations For Microsoft Office SharePoint Server 2007 versions SP2 through SP3, update the permissions for search scopes to properly restrict access. For SharePoint Server 2010 versions Gold through SP1, modify the search-scope URL parameters to prevent unauthorized changes. For Office Web Apps 2010 versions Gold through SP1, restrict access to search scopes to prevent information disclosure or tampering.

Fix

DoS

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2012-1860

Affected Products

Office Sharepoint Server 2007

Office Web Apps 2010

Sharepoint Server 2010

Sharepoint Server

References · 6

• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-1860 · Security Note
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2012/ms12-050 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2012-1860 · Security Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15265 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-1860 · Note
• http://technet.microsoft.com/en-us/security/bulletin/ms12-050 · Note